标签：#aigovernance

At 5:21 p.m. Eastern on Friday, June 12, Anthropic received a United States government directive. By nightfall, two of the most capable artificial-intelligence models in the world had gone dark after a Commerce Department export-control directive prompted Anthropic to take them offline worldwide. The directive required Anthropic to prevent access to Claude Fable 5 and Claude Mythos 5 by any foreign national, whether that person was inside or outside the United States. It extended even to Anthropic's own foreign-national employees. Because the company had no reliable way to verify every user's nationality in real time, it suspended both models for everyone . The controls remained in place until June 30. On July 1, Anthropic restored Fable globally. Mythos took a narrower path: after government approval on June 26, access returned to a set of United States organizations while Anthropic continued coordinating with the government over broader domestic and international access. That sounds like a short outage with a happy ending. It was neither. I have spent years building systems where a dependency going unavailable is not an abstraction. Once software is woven into a product or an operating process, access to it becomes part of the architecture. A model that can be withdrawn immediately under a company-specific determination and factual rationale no customer could have read is no longer only a technical dependency. It is a bet on unpublished policy. The United States needs to govern frontier A.I. It also needs companies, researchers, investors, and customers to know what the rules are before the government enforces them. June showed how far apart those two needs remain. The security concern was real The government's concern was not invented. Fable and Mythos shared the same underlying model, but Fable was released with strong safeguards for general use while Mythos, with fewer safeguards, went only to a small group of defensive-cybersecurity partners. Anthropic says My

The Observability Black Box As autonomous AI agents evolve from isolated chat assistants into multi-agent systems executing multi-step business logic across databases, APIs, and microservices, enterprise platform teams face an acute operational challenge: black-box opacity. When an autonomous agent fails, hallucinates, or executes an out-of-bounds API call, traditional Application Performance Monitoring (APM) tools fall short. Standard HTTP request logging and basic prompt-response captures cannot reconstruct the non-deterministic reasoning loops, tool selection branches, or sub-agent delegations that led to an incident. Furthermore, enterprise auditors, security teams, and regulatory bodies (governed by SOC 2, FedRAMP, and the EU AI Act) now require non-repudiable proof of agent execution. Organizations must be able to answer five fundamental questions for every production run: Which human or non-human identity authorized the agent run? What planner reasoning path or tool routing logic was chosen? Which exact data assets or vector embeddings were retrieved into context? What was the precise execution latency, token cost, and error tax of each intermediate step? Can the complete execution graph be cryptographically reconstructed for compliance review? To resolve this challenge, platform engineering teams must deploy Audit, Observability & Lineage —an architecture anchored in OpenTelemetry (OTel), OWASP Agent Observability Standards, and immutable lineage graphs. Deep-Dive Architecture: OpenTelemetry & Lineage Integration A production-grade Agent Observability stack avoids proprietary vendor lock-in by standardizing on OpenTelemetry (OTel) OTLP trace ingestion and open metadata stores. 1. The Unified OpenTelemetry Span Tree Every agent execution unit — from user intent trigger to final task completion — is encapsulated within a single root trace context ( agent.run ). Sub-tasks, tool calls, and model invocations are recorded as hierarchical child spans: [ Root Trace:

Part 1 documented the recurring snapback in practice. This note asks a narrower question: what does the observed pattern support, what remains a working hypothesis, and what changes should follow in the project? Status: Bounded project conclusion. This note separates observed behaviour, working hypothesis, and practical consequence. It is based on current project documents and interactions; it is not external validation or a universal claim about AI systems. What the evidence supports 1. The project already contains a stable relational model The working model is not generic “AI assistance.” It separates reasoning surfaces, uses bounded comparisons, permits two-way cognitive pressure, and keeps final acceptance authority with the human. Reciprocal cognitive contribution, asymmetrical governing authority. 2. Concrete project work preserves the structure better than public abstraction At the concrete level, instructions such as: Review this proposal against that architecture. preserve the distinction between the object being reviewed, the surface applying pressure, the evidence, and the authority that may accept a change. When the same structure was compressed into general prose, generated explanations repeatedly returned to a simpler one-way model of either human control or transferred AI authority. That is an observed pattern in this development process. 3. Public explanation is a separate reasoning surface A README, article, summary, or portfolio page is a projection of the model, not the model itself. It cannot be assumed to reproduce the internal structure faithfully merely because that structure is present in context. The explanation must be reviewed against the model it represents: Does this explanation preserve the actual authority, review, evidence, and state-transition structure? 4. Annoyance was useful boundary data The irritation indicated that the generic rendering was no longer merely an imperfect exploration. It was colliding with an internal frame that

Part 1 of "Trust the Machine" -> a series on building AI infrastructure that is secure, compliant, and governable by design. Most organizations can produce an accurate catalog of the web services they operate. Far fewer can produce an equivalent catalog of the AI systems they run — the models, fine-tunes, retrieval pipelines, agents, and third-party AI APIs now embedded throughout their products and internal tooling. This asymmetry defines the state of AI security in 2026. Adoption has outpaced oversight. Industry reporting this year has described a surge in enterprise AI activity on the order of 83% year over year, with governance and visibility lagging well behind. The consequence is a large and only partially mapped attack surface — one that many organizations cannot fully enumerate, let alone defend. Every mature security program rests on a single first principle: you cannot protect what you cannot see. Artificial intelligence is no exception. Before threat-modeling an agent or authoring a guardrail, an organization must be able to answer a deceptively difficult question: what AI is running across the environment, and who is accountable for it? This post examines how to build that answer. The rise of shadow AI Shadow IT — the unsanctioned adoption of tools outside official channels has been a recognized challenge for decades. Shadow AI is its faster-moving successor, and it appears in more forms than most inventories are designed to detect: Embedded API calls. A product team integrates a hosted model in a few lines of code and an API key, with no formal review. Copilots and assistants enabled across existing SaaS platforms, frequently activated by the vendor rather than the customer. Fine-tunes and adapters trained on internal data and stored in locations that fall outside standard scanning. Agents and automations that have incrementally acquired the ability to act—filing tickets, sending communications, initiating transactions—one permission at a time. Model de

GA in a sentence GitHub moved its enterprise managed-settings.json to general availability on July 1, giving GitHub Enterprise Cloud admins a single JSON file that overrides Copilot behaviour in VS Code and Copilot CLI for anyone holding a Copilot Business or Copilot Enterprise seat issued from the enterprise or one of its organizations. The changelog frames it as a place to define AI standards for the tenant. In practice it is a supported home for Copilot policy that shipped one setting at a time in beta up to this point. The five keys the file accepts Five keys are documented at GA: extraKnownMarketplaces , enabledPlugins , strictKnownMarketplaces , disableBypassPermissionsMode , and model . Together they configure trust for extra plugin marketplaces, the enabled-plugins list, strict enforcement of the known-good marketplace list, whether Copilot CLI and the VS Code extension can run in bypass-permission mode, and which model a user is allowed to pick. Value shapes are not enumerated in the changelog itself; the docs page is the reference for the schema. How the file reaches a client The file lives at copilot/managed-settings.json inside the .github-private repository of the organization the enterprise nominates for the role. There is a backward-compatible path at .github/copilot/settings.json for tenants already using the older layout. Copilot clients fetch the file from the server on every authentication, hold it in memory, and refresh it hourly, per the changelog. That server-side file takes precedence over the file-based config a user may have on their own machine. Setup runs through the AI Controls tab in enterprise settings, or the equivalent API endpoint, where an admin picks the hosting organization. Anyone who followed the June rollouts of disableBypassPermissionsMode and strictKnownMarketplaces will recognise the same file and the same repo. GA is what turns the plumbing into a supported product surface. Where it will trip you Two operational details are

Where AI incidents in legal actually come from, and what infrastructure (not policy) prevents them. Blake Aber · Predicate Ventures · 2026 The policy layer is table stakes. It isn't enough. When Sullivan & Cromwell apologized to a federal bankruptcy judge in April 2026 for AI hallucinations in a court filing, the firm's apology letter said the firm had policies. Safeguards existed. Those safeguards weren't followed. That framing, "the safeguard existed but wasn't followed," is how a policy failure gets described. But something more specific happened: a hallucination was generated, wasn't caught at generation time, wasn't caught at review time, and made it into a document that got filed. That's not a policy problem. It's an infrastructure problem. The distinction matters because it determines what you build next. What policy can and can't do Policy is a promise made before the event. A well-written AI acceptable-use policy says: don't submit output you haven't reviewed; verify citations before they go into a document; a human must approve anything client-facing. This works when the human executing the task has time, attention, and professional accountability in that moment. It fails when one of those is missing: a deadline, a junior practitioner, a late-night run. Policy can't: Verify a citation at the point of generation Flag output that has drifted below a confidence threshold Stop hallucinated text from appearing in a draft before a human ever sees it Detect when the underlying model is behaving differently than it was in testing Policy can: Set the expectation that review must happen Define who bears accountability when it doesn't Create a paper trail after the fact One of those is prevention. The other is compliance. What infrastructure does instead An AI harness layer operates at the point of generation, not at the point of review. This reflects a broader reality that production AI is mostly harness and very little model . For legal work specifically, three com

Why AI programs at PE portfolio companies stall at the same organizational seam, and what to do about it. Blake Aber · Predicate Ventures · 2026 There's a failure mode I've watched play out at enough portfolio companies that I've given it a name: the ownership dyad. It goes like this. The AI program is running. The product manager owns the roadmap (what the AI should do). Engineering owns the deployment (how it does it). Both parties are competent. Both are aligned on the goal. And the AI initiative quietly stalls anyway, usually somewhere between the promising pilot and the production system that was supposed to follow. The mechanism is diffuse accountability at the decision layer. What the dyad looks like in practice In the average portco planning meeting, the PM and the engineering lead sit across from each other. The PM has a change request: "The model is producing summaries that miss the key clause in contracts above a certain length. We should fix this." Engineering hears this and wants to know: is this a prompt change or a model change? Either requires scoping, and scoping requires the PM's input on acceptable behavior. So engineering asks the PM. The PM says "whatever's best technically." Engineering ships a prompt change. The next month, the same issue appears in a different context. The PM brings it back. Neither person is wrong. Neither person is slacking. The problem is structural: there's no single person who can describe (precisely and completely) what the AI should produce, evaluate whether it's producing it correctly, and approve a change to the system without requiring the other party's sign-off. The dyad looks like shared ownership. It functions as diffuse accountability. No one is in charge of the model's behavior. The failure mode at month nine Most portco AI programs that make it through a successful pilot still die quietly around month nine of production. The most common reason is not that the model got worse. It's that the harness around the m

Coding agents are no longer just autocomplete with a longer prompt. GitHub describes Copilot cloud agent as software that can research a repository, create an implementation plan, make code changes on a branch, run in an ephemeral GitHub Actions-powered environment, and let a developer review or create a pull request afterward. OpenAI's Codex GitHub integration similarly positions code review as a repository-aware review pass that follows AGENTS.md guidance and focuses comments on serious issues. That shift changes the buyer question. The useful question is not "does the agent usually write code?" It is "can the team detect when the agent drifts away from the developer's intent before the change reaches production?" A May 2026 arXiv paper, "How Coding Agents Fail Their Users" , gives teams a better vocabulary for that review. The authors studied 20,574 real IDE and CLI coding-agent sessions across 1,639 repositories and define misalignment as a breakdown that becomes visible through developer correction or pushback. The paper reports seven recurring symptom categories: wrong project diagnosis, misread developer intent, developer constraint violation, self-initiated overreach, faulty implementation, operational execution error, and inaccurate self-reporting. Effloow Lab also ran a bounded OpenAI API check using three synthetic, non-confidential coding-agent transcript snippets. The run did not measure real-world incidence, compare vendors, or reproduce the paper. It produced a small rubric that maps visible symptoms to review gates such as diff-scope checks, evidence-before-edit checks, acceptance-criteria coverage, and verification-output requirements. The public lab note is available at /lab-runs/coding-agent-misalignment-failure-taxonomy-poc-2026 . This guide turns that research and lab output into a practical QA checklist for teams buying, piloting, or packaging coding-agent workflows. Why This Matters for Agent Buyers Coding-agent procurement often starts with p